CVE-2025-62241
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-13

Last updated on: 2025-11-12

Assigner: Liferay Inc.

Description
Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses in Liferay DXP 2023.Q4.1 through 2023.Q4.5 allows remote authenticated users to from one virtual instance to view the shipment addresses of different virtual instance via the _com_liferay_commerce_order_web_internal_portlet_CommerceOrderPortlet_commerceOrderId parameter.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-13
Last Modified
2025-11-12
Generated
2026-06-16
AI Q&A
2025-10-13
EPSS Evaluated
2026-06-14
NVD
CVE-2025-62241
Affected Vendors & Products
Showing 5 associated CPEs
Vendor Product Version / Range
liferay digital_experience_platform 2023.q4.1
liferay digital_experience_platform 2023.q4.2
liferay digital_experience_platform 2023.q4.3
liferay digital_experience_platform 2023.q4.4
liferay digital_experience_platform 2023.q4.5
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2025-62241 is an Insecure Direct Object Reference (IDOR) vulnerability in Liferay DXP versions 2023.Q4.1 through 2023.Q4.5. It allows remote authenticated users to view shipment addresses from different virtual instances by manipulating the parameter `_com_liferay_commerce_order_web_internal_portlet_CommerceOrderPortlet_commerceOrderId`. This happens because the system does not properly restrict access between virtual instances, enabling unauthorized access to shipment address data. [1]

Impact Analysis

This vulnerability can lead to unauthorized disclosure of shipment address information across different virtual instances. Remote authenticated users could access sensitive shipment address data that they should not have permission to view, potentially leading to privacy breaches or misuse of personal information. [1]

Detection Guidance

This vulnerability can be detected by testing whether an authenticated user can access shipment addresses from different virtual instances by manipulating the parameter `_com_liferay_commerce_order_web_internal_portlet_CommerceOrderPortlet_commerceOrderId` in requests to the Liferay Commerce Order Portlet. You can use tools like curl or Burp Suite to send authenticated HTTP requests with modified commerceOrderId parameters and observe if shipment addresses from other virtual instances are returned. For example, a curl command might look like: curl -b cookies.txt 'https://your-liferay-instance.com/path?_com_liferay_commerce_order_web_internal_portlet_CommerceOrderPortlet_commerceOrderId=some_id' -v and then modify the commerceOrderId to test access to other instances' data. [1]

Mitigation Strategies

The immediate mitigation step is to upgrade Liferay DXP to a fixed version where this vulnerability is resolved. The fix is included in Liferay Portal 7.4.3.112, Liferay DXP 2024.Q1.1, and Liferay DXP 2023.Q4.6. Until the upgrade can be applied, restrict access to the affected portlet and monitor authenticated user activities to detect any unauthorized access attempts. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-62241. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart